# CVE-2026-110737: Vaadin server push CORS header injection

Source: https://junglewise.ai/threats/cve-2026-110737-the-push-endpoint-of-a-vaadin-application-that-uses-server-push  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-110737 · Severity: info · Published 2026-10-27

Vaadin's server push feature reflects the Origin header from user requests directly into CORS response headers, allowing attackers on any website to make authenticated requests to a Vaadin application's push endpoint and potentially read responses. An attacker would need to know the session's push identifier and trick a logged-in user into visiting a malicious website to exploit this vulnerability.

Technologies: [Vaadin](https://junglewise.ai/threats/technologies/vaadin). Vendors: [Vaadin](https://junglewise.ai/threats/vendors/vaadin).

## Quick answers

**Is CVE-2026-110737 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110737 being exploited in the wild.

**How severe is CVE-2026-110737?** Informational severity, published 27 October 2026.

**Which products and versions are affected?** Vaadin Flow Server 2.13.0-2.13.7, 23.6.0-23.6.15, 24.4.0-24.4.18, 24.5.0-24.5.17, 24.6.0-24.6.14, 24.7.0-24.7.15, 24.8.0-24.8.16, 24.9.0-24.9.28, 24.10.0-24.10.14, 25.0.0-25.0.15, 25.1.0-25.1.18, 25.2.0-25.2.12, 25.3.0-25.3.3; Vaadin Framework 7.1.0-7.7.54, 8.0.0-8.32.1; Vaadin 14.14.0-14.14.7, 23.6.0-23.6.16, 24.4.0-24.4.25, 24.5.0-24.5.15, 24.6.0-24.6.13, 24.7.0-24.7.16, 24.8.0-24.8.17, 24.9.0-24.9.23, 24.10.0-24.10.11, 25.0.0-25.0.13, 25.1.0-25.1.13, 25.2.0-25.2.10, 25.3.0-25.3.2.

**Is there a fix for CVE-2026-110737?** Yes: fixed in Vaadin 14.14.8, 23.6.17, 24.4.26, 24.7.17, 24.9.24, 24.10.12, 25.2.11, 25.3.3; Vaadin Framework 7.7.55, 8.32.2; Flow Server 2.13.8, 23.6.16, 24.4.19, 24.7.17, 24.9.29, 24.10.15, 25.1.19, 25.2.13, 25.3.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110737 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110737?** Check whether you run Vaadin Flow Server, Vaadin Framework or Vaadin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Vaadin 14.14.8, 23.6.17, 24.4.26, 24.7.17, 24.9.24, 24.10.12, 25.2.11, 25.3.3; Vaadin Framework 7.7.55, 8.32.2; Flow Server 2.13.8, 23.6.16, 24.4.19, 24.7.17, 24.9.29, 24.10.15, 25.1.19, 25.2.13, 25.3.4

## Technical details

The vulnerability exists in Vaadin's CorsInterceptor, which echoes whatever Origin a request carries into the Access-Control-Allow-Origin response header while credentials are allowed (due to Atmosphere being configured with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false). This enables cross-origin requests from any webpage to the push endpoint with the user's credentials. The issue affects only applications using the @Push annotation; the WebSocket transport and applications without push are unaffected.

## Affected products

- Vaadin Vaadin 14.14.0-14.14.7, 23.6.0-23.6.16, 24.4.0-24.4.25, 24.5.0-24.5.15, 24.6.0-24.6.13, 24.7.0-24.7.16, 24.8.0-24.8.17, 24.9.0-24.9.23, 24.10.0-24.10.11, 25.0.0-25.0.13, 25.1.0-25.1.13, 25.2.0-25.2.10, 25.3.0-25.3.2
- Vaadin Vaadin Framework 7.1.0-7.7.54, 8.0.0-8.32.1
- Vaadin Flow Server 2.13.0-2.13.7, 23.6.0-23.6.15, 24.4.0-24.4.18, 24.5.0-24.5.17, 24.6.0-24.6.14, 24.7.0-24.7.15, 24.8.0-24.8.16, 24.9.0-24.9.28, 24.10.0-24.10.14, 25.0.0-25.0.15, 25.1.0-25.1.18, 25.2.0-25.2.12, 25.3.0-25.3.3

## Timeline

- 2026-10-27: disclosed: CVE-2026-110737 published
- 2015-01: other: Vulnerable behavior introduced

## Related threats

- [Vaadin Framework 8 session lock denial of service](https://junglewise.ai/threats/cve-2026-110803-vaadinservice-requestend-in-vaadin-framework-8-locks-the-session)
- [Vaadin Charts multiple XSS and prototype pollution in bundled Highcharts](https://junglewise.ai/threats/cve-2026-107588-vaadin-charts-renders-charts-with-the-highcharts-library-and)
- [Vaadin Spreadsheet missing authorization check in cell comments](https://junglewise.ai/threats/cve-2026-93547-a-missing-authorization-check-in-the-vaadin-spreadsheet-component)
- [Vaadin Charts and Component Base prototype pollution in deep merge](https://junglewise.ai/threats/cve-2026-91860-a-prototype-pollution-vulnerability-exists-in-the-deep-merge)